CVE-2026-39823

MEDIUM6.1

Description

CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the <content> attribute, the escaper would fail to similarly escape it, leading to XSS.

CVSS breakdown

CVSS 3.1

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Affected products

Go standard library / html/template0 – 1.25.10
Go standard library / html/template1.26.0-0 – 1.26.3

References

MISChttps://go.dev/issue/78913
MISChttps://go.dev/cl/769920
MISChttps://groups.google.com/g/golang-announce/c/qcCIEXso47M
MISChttps://pkg.go.dev/vuln/GO-2026-4982

Updated 16m ago · 8 sources